Re: [PATCH] usb: gadget: net2280: fix NULL pointer deref in usb_reinit_338x()

[Greg KH]

On Fri, Aug 21, 2026 at 05:42:20PM +0530, Deepanshu Kartikey wrote:
> net2280_probe() only maps dev->llregs when the PLX_PCIE quirk bit is
> set. usb_reinit() dispatches to usb_reinit_338x() for any device that
> doesn't have PLX_LEGACY set, assuming such a device must have
> PLX_PCIE set (and thus llregs mapped). That assumption holds for
> every entry in the driver's pci_device_id table, but a forced driver
> bind (e.g. via sysfs bind/driver_override) can invoke probe() with
> quirks that have neither bit set, leaving llregs NULL and crashing
> in usb_reinit_338x() on the first readl().

What is it with the forced bind patches coming out of the woodwork?  Did
syzbot just decide to go crazy here?

Again, no, this isn't a real issue.  If you try to do a bind to a random
driver, you will get random results, including crashes.  This is a
debugging-only feature for people who want to break their kernels :)

thanks,

greg k-h